The sweeping California Consumer Privacy Act (CCPA) was enacted last June at light speed—having been resurrected from the inactive file and approved by then-Governor Jerry Brown within a week. The CCPA was passed with the understanding that it would go through an extensive amendment process before it goes into effect on January 1, 2020.
That process reached a major milestone on May 31, the California State Legislature’s “house of origin” deadline. The house of origin deadline is the date by which any bill introduced in this legislative session must pass the house of the legislature it was introduced in. If the bill has not passed the house it was introduced in by this date it cannot be considered for the remainder of the legislative term, which ends on September 13.
While we won’t know what the final version of the CCPA will look like until after the still-pending amendments are resolved, we know which amendments are still in play and which will not make it into the CCPA when it goes into effect in 2020.
Amendments still in play
- A.B. 25 – Clarifies the definition of “consumer” to ensure it does not apply to employee data retained by employers.
- A.B. 846 – Carves out customer loyalty programs from the CCPA’s restrictions.
- A.B. 873 – Tweaks the definition of “disidentified” to add a “reasonableness” standard to whether information can be linked to a particular consumer.
- A.B. 874 – Expands the definition of “publicly available” information that is exempted by the CCPA by removing the requirement that publicly available information is only exempt if it is used for a purpose that is compatible with the purpose for which the data is maintained and made available.
- A.B. 981 – Carves out the retention and sharing of consumer information necessary to complete an insurance transaction requested by the consumer from the CCPA’s protections.
- A.B. 1035 – Modifies data breach reporting requirements, including placing a strict 45-day limit for companies to disclose data breaches.
- A.B. 1146 – Exempts certain vehicle information (such as Vehicle Identification Numbers) from the certain provisions of the CCPA, including the right to delete and the right to opt-out of sales.
- A.B. 1202 – Requires data brokers to provide consumers the right to opt-out of sales of their personal information and requires data brokers to register with the attorney general and subjects them to civil penalties for failing to register.
- A.B. 1281 – Requires businesses that use facial recognition technology to post a sign disclosing that fact.
- A.B. 1355 – Fixes several drafting errors but does not substantively change the Act.
- A.B. 1416 – Adds a carve-out from do not sell and deletion rules for auto warranty and recall purposes.
- A.B. 1564 – Decreases the number of ways consumers can submit information requests to data holders.
Amendments that are dead for now
- A.B. 288 – Required social media companies to allow users specific rights to delete or otherwise restrict the use of their data permanently.
- A.B. 950 – Required companies to disclose certain facts relating to data on their websites and also would have established a Consumer Data Privacy Commission.
- A.B. 1760 – Would have greatly expanded the CCPA’s private right of action, among several other measures that would have expanded the protections in the Act. A similar amendment, S.B. 561, failed in the Senate.
- S.B. 753 – Sought to carve-out certain advertising activities from the broad definition of “sale” under the CCPA.
Pending non-CCPA privacy-related legislation
The CCPA is getting most of the attention, but there are several other privacy-related laws still pending in this California legislation session, including:
- A.B. 1130 – Amends the definition of personal information in California’s data breach notification law to include biometric data and government-issued identification numbers.
- A.B. 1138 – Prohibits social media companies from allowing persons under 13 years of age to create an account without a parent’s consent.
- A.B. 1395 – Expands California’s smart TV privacy bill to apply to any connected device with a voice recognition feature. Generally requires notice of the feature, and prohibits the sale of recordings or the use of recordings for advertising.
- A.B. 1665 – Requires parental consent before a website or application can sell a minor’s personal information in a manner that is separate from that website or application’s general terms and conditions.